Medium severity4.1OSV Advisory· Published Jun 24, 2026· Updated Jun 26, 2026
CVE-2026-56272
CVE-2026-56272
Description
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
flowisenpm | < 3.0.13 | 3.0.13 |
Affected products
3[email protected], [email protected], [email protected], …+ 2 more
- (no CPE)range: [email protected], [email protected], [email protected], …
- cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*range: <3.0.13
- (no CPE)range: <3.0.13
Patches
Vulnerability mechanics
References
5- github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvpnvdMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-x2g5-fvc2-gqvpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-56272ghsaADVISORY
- www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashingnvdThird Party AdvisoryWEB
- github.com/FlowiseAI/Flowise/pull/5665ghsaWEB
News mentions
0No linked articles in our index yet.